IntenseWebs/mattermost
3
0
Fork 0
mirror of https://github.com/mattermost/mattermost.git synced 2025-02-25 18:55:24 -06:00
Code Issues Packages Projects Releases Wiki Activity

MM-14146 Update CSP for local image proxy (#10277)

Browse Source
This commit is contained in:
Harrison Healey
2019-02-12 15:27:17 -05:00
committed by GitHub
parent 285b646d67
commit 87e36a3ecf
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
services/imageproxy/local.go
View File

@@ -71,6 +71,11 @@ func (backend *LocalBackend) GetImage(w http.ResponseWriter, r *http.Request, im
return
}
w.Header().Set("X-Frame-Options", "deny")
w.Header().Set("X-XSS-Protection", "1; mode=block")
w.Header().Set("X-Content-Type-Options", "nosniff")
w.Header().Set("Content-Security-Policy", "default-src 'none'; img-src data:; style-src 'unsafe-inline'")
backend.impl.ServeHTTP(w, req)
}